Wibu-Systems CodeMeter Runtime

CVEs (2)

Remediations

• CAPE 14 installations installed from material dated 2021-06-16 or later are not affected, as they contain a fixed version of CodeMeter Runtime.
• If CAPE 14 was initially installed using earlier material, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.psscape.com/codemeter and install it the same way as documented for previous versions in the PSS CAPE 14 Installation Manual. Contact PSS(R)CAPE Support at [email protected] if you need assistance with patching affected systems.
• Installations of PSS(R)CAPE are only affected if network access to CodeMeter Runtime is enabled. This is not the default configuration and is not necessary for any functionality in PSS(R)CAPE.
• Update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.21a or V7.30a: Download the package from: https://www.wibu.com/us/support/user/downloads-user-software.html. Install it on SICAM 230 systems according to the procedure documented in chapter 9.2 of the COPA-DATA Security Vulnerability Announcement 2021_1: https://www.copadata.com/fileadmin/user_upload/faq/files/CD_SVA_2021_1.pdf.
• Currently no remediation is planned
• Update SIMATIC PCS neo to V3.1 or later version
• Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running.
• Update to V3.1 or later version
• Update to V3.17 P013 or later version
• Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running (for details refer to the updated security manual of WinCC OA).
• Update to V3.18 P002 or later version
• Update to V10.3 Upd1 or later version
• Alternatively, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems.
• Update to V1.0.1 Update 1 or later version
• Alternatively, update CodeMeter Runtime to V7.21a: Download the package "CodeMeter User Runtime for Linux, version 7.21a, Driver-only" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command: "sudo dpkg --force-depends --force-confnew -i codemeter-7.21.4611.501_amd64.deb"
• Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running. Note that this is the default configuration, which therefore limits the exploitability to local attacks only.
• Update to V3.0 SP2 or later version

Affected Vendors

Affected Products (10)

Affected Sectors

Multiple